Hi everyone. This is Huadi Zhu.
I’m from the University of Texas at Arlington.
In this video, I'll present our paper, BlinKey:
A Two-Factor User Authentication Method for Virtual Reality Devices.
This is a joint work with Wenqiang Jin, Mingyan Xiao, Srinivasan Murali, and Dr. Ming Li.
Virtual reality has shown rapid growth and great potential over the past few years.
The value of VR market is forecast to reach nearly 88 billion dollars
in 2025, which is more than 6 times larger than that in 2019.
At the same time, massive personal information is stored in these VR devices, such as emails,
photos, account information, and bank information.
If left unattended, it may result in potential hazards in privacy and security.
Therefore, it is crucial to employ user authentication
for VR devices so that only the legitimate user can unlock the device.
Prior works explore conventional
and novel user authentication schemes on VR devices, including knowledge-based
and biometric-based solutions.
Unfortunately, all these solutions either show vulnerability against
attacks, or are difficult to perform, or require expensive and advanced input devices.
Therefore, a robust and convenient authentication method for VR devices in dire need.
In this work, we introduce BlinKey,
a novel user authentication method
for virtual reality devices based on the real-time pupil data
captured by an embedded eye tracker.
A blinkey has two components: blink pattern and pupil size adaption.
The former identifies the blink rhythm, blink onset and offset
timestamps, and intervals.
These are customized and memorized by the user.
Instead of digit numbers or patterns, it is the time and rhythm that differentiate the blinkeys.
The letter denotes the biological adaption pattern after
each blink that is unique by user.
To authenticate, a user is only required to blink
according to their registered blink pattern.
Since the entire entry process is performed inside the VR device,
it prevents the observer's attacks and it is easy to perform.
We identify BlinKey as a two-factor authentication scheme
since it leverages both knowledge-based and biometric information.
BlinKey consists of two phases, a registration phase and a login phase.
In each phase, the eye tracker collects the user’s pupil data,
including a blink pattern signal and pupil size adaption signals.
The former one is customized by users, and the latter are based on their biological information.
After pre-processing, we extract certain features from the blink pattern signal
and from the pupil size adaption signals on time and frequency domains.
By applying a k-NN classifier on the extracted features,
BlinKey is able to compare a user's entry in the login phase with
the enrolled key during the registration phase
and decide if it's the legit user.
We implement BlinKey on an HTC Vive Pro VR device with a pupil labs eye tracker installed.
The device is connected to a local server running Unity as the software platform.
We evaluate the security of BlinKey against four types of attacks.
Zero effort attacks, where the attacker randomly guesses the secret key.
Statistical attacks, where the attacker forges
the secret key by frequency of features.
BlinKey achieves low FAR against these two types of attacks.
Especially, the FAR drops to zero
as the blinkey length reaches 7 and 8, respectively.
In shoulder-surfing attacks, where the attacker
observes the user entering the key, BlinKey presents much
better security than PIN and pattern lock do.
For credential aware attacks, where the attacker knows the complete information,
BlinKey remains high security while conventional schemes become vulnerable.
We evaluate the usability of BlinKey from the aspects of login time and login attempts.
The average login time is 9.6 seconds,
which is within an average range for practical use.
More than 93% of blinkeys can be successfully authenticated in the first attempt,
which is much larger than that of PIN and pattern lock.
This means that the legit user is very unlikely to be denied access on the first attempt.
Here we show the demos of: the registration phase, in which the user enrolls the blinkey several times.
A successful login attempt, in which the entered blinkey is considered the same as the enrolled one.
And a failed attempt.
For more details, please refer to our paper.
Thank you for watching.